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DETAILED ACTION 

1 . This action is responsive to communications: Amendment, filed 05/04/2006. 

2. Claims 1-11, 13-21, 23-31, and 33-36 are pending in the case. Claims 1. 14. and 
24 are independent claims. Claims 37 and 38 have been cancelled. 

Information Disclosure Statement 

3. The information disclosure statement filed 05/04/2006 fails to comply with the 
provisions of 37 CFR 1.97. 1.98 and MPEP § 609 because p. 5-7 of the IDS. items C2- 
C33 cites Office Actions for various patent applications, which are neither patents nor 
publications, and do not constitute prior art. It has been placed in the application file, 
but the information referred to therein has not been considered as to the merits. 
Applicant is advised that the date of any re-submission of any item of information 
contained in this information disclosure statement or the submission of any missing 
element(s) will be the date of submission for purposes of determining compliance with 
the requirements based on the time of filing the statement, including all certification 
requirements for statements under 37 CFR 1.97(e). See MPEP § 609.05(a). 

Claim Rejections - 35 USC § 101 

4. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

5. Claims 1-11, 13-21, 23-31, and 33-36 are rejected under 35 U.S.C. 101 
because the claimed invention is directed to non-statutory subject matter. 
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6. In regard to independent claim 1, claim 1 claims a method for using workflows, 
comprising a series of steps. Claim 1 is directed to non-statutory for two reasons. First, 

A 

the claimed invention as a whole must accomplish a practical application. That is. it 
must produce a "useful, concrete, and tangible result." State Street, 149 F.3d at 1373- 
74. 47 USPQ2d at 1601-02. (See Interim Guidelines for Examination of Patent 
Applications for Patent Subject Matter Eligibility, p. 1 and 51). Claim 1 does not satisfy 
the practical application requirement because the association of workflows with groups 
and performing a task is not sufficient to show a practical application. Secondly, claim 1 
is not recorded on any computer-readable medium, so that even if the practical 
application requirement were satisfied, the requisite functionality would still not be 
present. Note that merely claiming nonfunctional descriptive material, i.e.. abstract 
ideas, stored in a computer, does not make it statutory. 

7. Regarding dependent claims 2-11 and 34-36, claims 2-1 1 and 34-36 are 
rejected because they add nothing to render the claimed subject matter statutory. 

8. In regard to independent claim 14. claim 14 claims processor readable storage 
device(s) having processor readable code used to perform the method as claimed in 
claim 1. While claim 14 is recorded on a computer readable medium, claim 14 does not 
satisfy the practical application requirement since claim 14 is directed toward a method 
substantially similar to claim 1 . 

9. Regarding dependent claims 15-21 and 23. claims 15-21 and 23 are rejected 
because they add nothing to render the claimed subject matter statutory. 
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10. In regard to independent claim 24, claim 24 claims an apparatus that uses 
workflows, comprising a communication interface and one or more processors in 
communication with the communication interface. However, claim 24 is not recorded on 
any computer-readable medium, and therefore may be descriptive material, i.e., 
software perse, and is not statutory because the elements of the apparatus are not 
capable of causing functional change in the computer, since they may be represented 
by software alone (See Interim Guidelines for Examination of Patent Applications for 
Patent Subject Matter Eligibility, p. 52). Further, claim 24 does not satisfy the practical 
application requirement since claim 14 is directed toward a method substantially similar 
to claim 1 . 

11. Regarding dependent claims 25-31 and 33, claims 25-31 and 33 are rejected 
because they add nothing to render the claimed subject matter statutory. 



Claim Rejections - 35 USC § 103 

1. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

2. Claims 1-37 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Du et al. (hereinafter "Du"), U.S. Patent No. 6,041,306, issued March 2000, in view 
of SiteMinder Policy Server Operations Guide, Version 4.0 (hereinafter 
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"SiteMinder"), Netegrity inc., published 1997 and submitted with Applicant's 
Information Disclosure Statement filed March 15, 2004. 

Amended independent claim 1 cites: A method for using workflows, 
comprising the steps of: associating workflows with one or more groups in an identity 
system, each group including one or more users of the identity system; 

receiving a request to perform a task that pertains to at least one identity profile 
of an entity in said identity system; and performing a first workflow for said task, said 
first workflow is associated with a first group that includes a target identity profile of said 
request; 

Du teaches a method for performing flexible workflow process execution in a 
distributed workflow management system (Abstract), and encapsulating legacy systems 
using business objects as a representation of something active in the business domain, 
to map between the business model and the operational procedures of the workflow 
process system (Col. 8, 1. 36-44; I. 52-64). Du teaches launching workflow process 
instances in response to user requests (Col. 7, 1. 45-46). Du teaches that a policy is a 
set of rules that determines how resources, i.e., users, are related to tasks (Col. 8, 1. 52- 
63). Although Du teaches applying policies to users, Du does not explicitly teach 
associating workflows with groups in an identity system. However, SiteMinder teaches 
a policy server, i.e., identity system, for associating workflows, i.e., rules for user 
interaction with system resources, with policy domains (p. 235-237) by using SiteMinder 
responses and response groups (Chapter 11, p. 302-304) and creating policies to 
specify actions that should take place when users access specific resources, which are 
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tasks and/or software within a domain (Chapter 12. Policies, p. 325-328). cximpare to 
associating workflows with one or more groups in an identity system, eacti group 
including one or more users of the identity system. Specifically, SiteMinder teaches that 
a policy domain is a logical grouping of resources associated with one or more user 
directories, i.e.. one or more users of the system (p. 235, par. 1; p. 235). 

Claim 1 also cites: wherein; said first workflow comprises a predefined set of 
steps that perform said tasks to affect the target identity profile, said predefined set of 
steps comprising a first step and a second step; 

said first step is perfonved by a first program; 

said second step is perfonved by a second program; 

infonvation is passed between said first program and said second program 
according to a defined set of rules: and 

at least one of the first program and the second program is external to the 
workflow, 

Du teaches creating workflow processes by assembling business objects in 
sequence, i.e., comprises a predefined set of steps that perform said tasks, and 
applying a set of rules for passing information between programs, and executing the 
flexible workflow processes as specified by a directed graph comprising a set of nodes 
connected by arcs (Col. 8. 1. 45-63; Col. 11. L 26-Col. 12, 1. 29). Du teaches resource 
mapping in flexible workflow paths that also support redirect resource mapping, which 
allows a business object to recommend another business object for a task (Col. 17, 1. 
25-40), compare to information is passed between said first program and said second 
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program according to a defined set of rules: and at least one of the first program and the 
second program is external to the workflow. The flexible workflow execution allows 
freedom of task assignment and external activities to be perfomied (Col. 12, L 41-43; 
Col. 6, 1. 39-49). 

Both Du and SiteMinder are analogous art, since both are directed toward policy 
and identity management. It would have been obvious to one of ordinary skill in the art 
at the time of the invention to apply SiteMinder to Du, so that Du would have the benefit 
of a policy server which would integrate applications and improve workflow by 
integrating directories and external databases in its policies so that legacy applications 
and systems could still be used (SiteMinder, p. 22-23, last paragraph). 

Regarding dependent claim 2, while Du does not explicitly teach associating a 
workflow with a hierarchical data structure, SiteMinder teaches creating a policy domain 
which contains zero or more realms (p. 241, "Creating a Realm"). SiteMinder teaches 
that realms represent groups of resources and realms can be nested within other 
realms to represent the grouping of network resources (p. 247-249, "Understanding 
Nested Realms"). Both Du and SiteMinder are analogous art, since both are directed 
toward policy management. It would have been obvious to one of ordinary skill in the 
art at the time of the invention to apply SiteMinder to Du, so that Du would have the 
benefit of a policy server which would integrate applications and improve workflow by 
integrating directories and external databases in its policies so that legacy applications 
and systems could still be used (SiteMinder, p. 22-23, last paragraph). 
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Regarding dependent claim 3, Du teaches identifying one or more workflows 
associated with a target identity profile (Col. 5, 1. 59-Col. 6, 1. 10). SiteMinder teaches 
associating resources with a policy domain (p. 235-236). Both Du and SiteMinder are 
analogous art, since both are directed toward policy management. It would have been 
obvious to one of ordinary skill in the art at the time of the invention to apply SiteMinder 
to Du, so that Du would have the benefit of a policy server which would integrate 
applications and improve workflow by integrating directories and externa! databases in 
its policies so that legacy applications and systems could still be used (SiteMinder, p. 
22-23, last paragraph). 

Regarding dependent claim 4, Du teaches that in flexible workflow process 
execution multiple workflows can be created and/or adapted to a user request, and that 
a user can identify a target identity profile of another user, thereby altering the workflow 
and a new workflow or set of workflows may be created to perform the task (Col. 19, 1. 
54-67). 

Regarding dependent claims 5 and 6, Du teaches that the user can request to 
delete or modify a target identity profile, for example the role specification and activity to 
a business object (Col. 19, 1. 54-67). In another example, the user can request to add 
or drop communication paths between certain endpoints in a private virtual network 
(Col. 10, 1.40-45). 

Regarding dependent claims 7 and 8, Du teaches the steps of identifying a set 
of one more workflows that perform a task and are associated with domains that include 
the target, and reporting one more workflow, and receiving from a user a selection of 
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the first workflow, and performing one or more steps of said first workflow, in the 
prototype of automatically configuring a data path with a flexible workflow (Fig. 6. Col. 
10, 1. 5-Col. 11, 1. 25). SiteMinder teaches a policy server, i.e., identity system, for 
associating workflows, i.e.. rules for user interaction with system resources, with policy 
domains (p. 235-237) by using SiteMinder responses and response groups (Chapter 11, 
p. 302-304) and creating policies to specify actions that should take place when users 
access specific resources, which are tasks and/or software within a domain (Chapter 
12, Policies, p. 325-328). Both Du and SiteMinder are analogous art, since both are 
directed toward policy and identity management. It would have been obvious to one of 
ordinary skill in the art at the time of the invention to apply SiteMinder to Du, so that Du 
would have the benefit of a policy server which would integrate applications and 
improve workflow by integrating directories and external databases in its policies so that 
legacy applications and systems could still be used (SiteMinder, p. 22-23, last 
paragraph). 

Regarding dependent claims 9 and 10, Du teaches the use of policies to 
ensure proper authorization and authentication (Col. 8, 1. 57-63), but Du does not 
explicitly teach an integrated identity and access system. However, SiteMinder 
comprises an integrated identity and access system (p. 20-24, "Overview") with user 
self-registration (p. 395, par. 2). Both Du and SiteMinder are analogous art, since both 
are directed toward policy management. It would have been obvious to one of ordinary 
skill in the art at the time of the invention to apply SiteMinder to Du, so that Du would 
have the benefit of a policy server which would integrate applications and improve 
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workflow by integrating directories and external databases in its policies so that legacy 
applications and systems could still be used (SiteMlnder. p. 22-23. last paragraph). 

Regarding dependent claim 11. Du teaches that workflows can delegate work 
to other workflow processes or resources (Col. 20, 1. 50-Col. 21, 1. 15). 

Regarding dependent claim 13. while Du does not explicitly teach associating a 
workflow with a hierarchical data structure, SiteMinder teaches creating a policy domain 
which contains zero or more realms (p. 241. "Creating a Realm"). SiteMinder teaches 
that realms represent groups of resources and realms can be nested within other 
realms to represent the grouping of network resources (p. 247-249. "Understanding 
Nested Realms"). SiteMinder teaches that the hierarchical data structure of policy 
domains and realms includes an LDAP directory (p. 352). Both Du and SiteMinder are 
analogous art, since both are directed toward policy management. It would have been 
obvious to one of ordinary skill in the art at the time of the invention to apply SiteMinder 
to Du, so that Du would have the benefit of a policy server which would integrate 
applications and improve workflow by integrating directories and external databases in 
its policies so that legacy applications and systems could still be used (SiteMinder. p. 
22-23, last paragraph). 

In regard to independent claim 14, claim 14 reflects the processor readable 
storage device(s) having processor readable code used to perform the method as 
claimed in claim 1 , and is rejected along the same rationale. 

In regard to dependent claims 15-21 and 23, claims 15-21 and 23 reflect the 
processor readable storage device(s) having processor readable code used to perform 
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the method as claimed in claims 2, 3. 4. 7-9, 11, and 13, and are rejected along the 
same rationale. 

In regard to independent claim 24, claim 24 reflects the apparatus used to 
perform the method as claimed in claim 1 , and is rejected along the same rationale. 

In regard to dependent claims 25-33, claims 25-31 and 33 reflect the 
apparatus used to perform the method as claimed in claims 2, 3, 4, 7-9, 11, and 13, and 
are rejected along the same rationale. 

Regarding dependent claims 34 and 35, while Du teaches a flexible workflow 
process execution system, Du does not explicitly teach managing a target identity 
profile. However, SiteMinder teaches automatically managing target user identity 
profiles using workflows, i.e., specifying templates and sequences for registration (p. 
398-399; p. 398-401). SiteMinder teaches applying domain policies to users (p. 141- 
416), i.e., changing a user attribute. Both Du and SiteMinder are analogous art, since 
both are directed toward policy management. It would have been obvious to one of 
ordinary skill in the art at the time of the invention to apply SiteMinder to Du, so that Du 
would have the benefit of a policy server which would integrate applications and 
improve workflow by integrating directories and external databases in its policies so that 
legacy applications and systems could still be used (SiteMinder, p. 22-23, last 
paragraph). 

Regarding dependent claim 36, while Du does not explicitly teach managing 
certificates, SiteMinder teaches managing certificates associated with identity profiles 
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(p. 533-536) via the user's browser. Both Du and SiteMinder are analogous art, since 
both are directed toward policy management. It would have been obvious to one of 
ordinary skill in the art at the time of the invention to apply SiteMinder to Du. so that Du 
would have the benefit of a policy server which would integrate applications and 
improve workflow by integrating directories and external databases in its policies so that 
legacy applications and systems could still be used (SiteMinder. p. 22-23, last 
paragraph). 



Response to Arguments 

Applicant's arguments filed 05/04/2006 have been fully considered but they are not 
persuasive. Applicant argues that the Du and SiteMinder references do not teach the 
newly claimed limitations associating workflows with one or more groups in an identity 
system, each group including one or more users of the identity system; 

receiving a request to perfomi a task that pertains to at least one identity profile 
of an entity in said identity system; and performing a first workflow for said task, said 
first workflow is associated with a first group that includes a target identity profile of said 
request; (Claim 1). However, SiteMinder teaches a policy server, i.e., identity system, 
for associating workflows, i.e., rules for user interaction with system resources, with 
policy domains (p. 235-237) by using SiteMinder responses and response groups 
(Chapter 1 1. p. 302-304) and creating policies to specify actions that should take place 
when users access specific resources, which are tasks and/or software within a domain 
(Chapter 12, Policies, p. 325-328). Specifically, SiteMinder teaches that a policy 
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domain is a logical grouping of resources associated with one or more user directories, 
i.e., one or more users of the system (p. 235, par. 1; p. 235). 

3. In response to applicant's argument that there is no suggestion to combine the 
references, the examiner recognizes that obviousness can only be established by 
combining or modifying the teachings of the prior art to produce the claimed invention 
where there is some teaching, suggestion, or motivation to do so found either in the 
references themselves or in the knowledge generally available to one of ordinary skill in 
the art. See In re Fine, 837 F.2d 1071 , 5 USPQ2d 1596 (Fed. Cir. 1988)and In re 
Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed, Cir. 1992). In this case, both Du and 
SiteMinder are analogous art, since both are directed toward policy management. It 
would have been obvious to one of ordinary skill in the art at the time of the invention to 
apply SiteMinder to Du, so that Du would have the benefit of a policy server which 
would integrate applications and improve workflow by integrating directories and 
external databases in its policies so that legacy applications and systems could still be 
used (SiteMinder, p. 22-23, last paragraph). 

Conclusion 

4. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
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mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Amelia Rutledge whose telephone number is 571-272- 
7508. The examiner can normally be reached on Monday - Friday 9:30 - 6:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Heather Herndon can be reached on 571-272-4136. The fax phone number 
for the organization where this application or proceeding is assigned is 571-273-8300. 
Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR. Status 
information for unpublished applications is available through Private PAIR only. For 
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you 
have questions on access to the Private PAIR system, contact the Electronic Business 
Center (EBC) at 866-217-9197 (toll-free). 
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